Multiple vulnerabilities have been discovered in curl, the worst of which could lead to information disclosure.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 8.7.1 | >= 8.7.1 |
A command line tool and library for transferring data with URLs.
Multiple vulnerabilities have been discovered in curl. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All curl users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-8.7.1"
Multiple vulnerabilities have been discovered in curl, the worst of which could result in arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 8.3.0-r2 | >= 8.3.0-r2 |
A command line tool and library for transferring data with URLs.
Multiple vulnerabilities have been discovered in curl. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details. Note that the risk of remote code execution is limited to SOCKS usage.
There is no known workaround at this time.
All curl users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-8.3.0-r2"
Multiple vulnerabilities have been found in curl, the worst of which could result in arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.86.0 | >= 7.86.0 |
A command line tool and library for transferring data with URLs.
Multiple vulnerabilities have been discovered in curl. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All curl users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.86.0"
Multiple vulnerabilities have been found in cURL, the worst of which could result in the arbitrary execution of code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.77.0 | >= 7.77.0 |
A command line tool and library for transferring data with URLs.
Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.77.0"
Multiple vulnerabilities have been found in cURL, the worst of which could result in information disclosure or data loss.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.74.0 | >= 7.74.0 |
A command line tool and library for transferring data with URLs.
Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.74.0"
Multiple vulnerabilities have been found in cURL, the worst of which could result in information disclosure or data loss.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.71.0 | >= 7.71.0 |
A command line tool and library for transferring data with URLs.
Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.71.0"
Multiple vulnerabilities have been found in cURL, the worst of which may lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.66.0 | >= 7.66.0 |
A command line tool and library for transferring data with URLs.
Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.66.0"
Multiple vulnerabilities have been found in cURL, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.64.0 | >= 7.64.0 |
A command line tool and library for transferring data with URLs.
Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details.
Remote attackers could cause a Denial of Service condition.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.64.0"
A heap-based buffer overflow in cURL might allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.61.0 | >= 7.61.0 |
A command line tool and library for transferring data with URLs.
A heap-based buffer overflow was discovered in cURL’s Curl_smtp_escape_eob() function.
An attacker could cause a Denial of Service condition or execute arbitrary code via SMTP connections.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.61.0"
Multiple vulnerabilities have been found in cURL, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.60.0 | >= 7.60.0 |
A command line tool and library for transferring data with URLs.
Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details.
Remote attackers could cause a Denial of Service condition, obtain sensitive information, or have other unspecified impacts.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.60.0"
Multiple vulnerabilities have been found in cURL, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.59.0 | >= 7.59.0 |
A command line tool and library for transferring data with URLs.
Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details.
Remote attackers could cause a Denial of Service condition, obtain sensitive information, or have other unspecified impacts.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.59.0"
Multiple vulnerabilities have been found in cURL, the worst of which may allow execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.57.0 | >= 7.57.0 |
A command line tool and library for transferring data with URLs.
Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details.
Remote attackers could cause a Denial of Service condition, disclose sensitive information or other unspecified impacts.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.57.0"
Multiple vulnerabilities have been found in cURL, the worst of which may allow attackers to bypass intended restrictions.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.55.1 | >= 7.55.1 |
cURL is a tool and libcurl is a library for transferring data with URL syntax.
Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details.
Remote attackers could cause a Denial of Service condition, obtain sensitive information, or bypass intended restrictions for TLS sessions.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.55.1"
A coding error has been found in cURL, causing the TLS Certificate Status Request extension check to always return true.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.53.0 | >= 7.53.0 |
cURL is a tool and libcurl is a library for transferring data with URL syntax.
cURL and applications linked against libcurl support “OCSP stapling”, also known as the TLS Certificate Status Request extension (using the CURLOPT_SSL_VERIFYSTATUS option). When telling cURL to use this feature, it uses that TLS extension to ask for a fresh proof of the server’s certificate’s validity. If the server doesn’t support the extension, or fails to provide said proof, cURL is expected to return an error. Due to a coding mistake, the code that checks for a test success or failure, ends up always thinking there’s valid proof, even when there is none or if the server doesn’t support the TLS extension in question.
Due to the error, a user maybe does not detect when a server’s certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.53.0"
Multiple vulnerabilities have been found in cURL, the worst of which could allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.52.1 | >= 7.52.1 |
cURL is a tool and libcurl is a library for transferring data with URL syntax.
Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers and bug reports referenced for details.
Remote attackers could conduct a Man-in-the-Middle attack to obtain sensitive information, cause a Denial of Service condition, or execute arbitrary code.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.52.1"
Multiple vulnerabilities have been found in cURL, the worst of which can allow remote attackers to cause Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.43.0 | >= 7.43.0 |
cURL is a tool and libcurl is a library for transferring data with URL syntax.
Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly obtain sensitive information, or cause a Denial of Service condition.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.43.0"
Multiple vulnerabilities have been discovered in cURL, the worst of which could lead to man-in-the-middle attacks.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.36.0 | >= 7.36.0 |
cURL is a command line tool for transferring files with URL syntax, supporting numerous protocols.
Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details.
A remote attacker could cause a man-in-the-middle attack via a crafted certificate issued by a legitimate certification authority. Furthermore, a context-dependent attacker may be able to bypass security restrictions by connecting as other users.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.36.0"
Multiple vulnerabilities have been found in cURL, allowing attackers to execute arbitrary code or cause Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.34.0-r1 | >= 7.34.0-r1 |
cURL is a command line tool for transferring files with URL syntax, supporting numerous protocols.
Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user or automated process to connect to a malicious server using cURL, possibly resulting in the remote execution of arbitrary code or a Denial of Service condition.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.34.0-r1"
Multiple vulnerabilities have been found in cURL, the worst of which might allow remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.24.0 | >= 7.24.0 |
cURL is a command line tool for transferring files with URL syntax, supporting numerous protocols.
Multiple vulnerabilities have been found in cURL:
A remote attacker could entice a user or automated process to open a specially crafted file or URL using cURL, possibly resulting in the remote execution of arbitrary code, a Denial of Service condition, disclosure of sensitive information, or unwanted actions performed via the IMAP, POP3 or SMTP protocols. Furthermore, remote servers may be able to impersonate clients via GSSAPI requests.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.24.0"
An error in the X.509 certificate handling of cURL might enable remote attackers to conduct man-in-the-middle attacks.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.19.6 | >= 7.19.6 |
cURL is a command line tool for transferring files with URL syntax, supporting numerous protocols.
Scott Cantor reported that cURL does not properly handle fields in X.509 certificates that contain an ASCII NUL (\0) character. Specifically, the processing of such fields is stopped at the first occurence of a NUL character. This type of vulnerability was recently discovered by Dan Kaminsky and Moxie Marlinspike.
A remote attacker might employ a specially crafted X.509 certificate (that for instance contains a NUL character in the Common Name field) to conduct man-in-the-middle attacks.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.19.6"
A vulnerability in cURL may allow for arbitrary file access.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.19.4 | >= 7.19.4 |
cURL is a command line tool for transferring files with URL syntax, supporting numerous protocols.
David Kierznowski reported that the redirect implementation accepts arbitrary Location values when CURLOPT_FOLLOWLOCATION is enabled.
A remote attacker could possibly exploit this vulnerability to make remote HTTP servers trigger arbitrary requests to intranet servers and read or overwrite arbitrary files via a redirect to a file: URL, or, if the libssh2 USE flag is enabled, execute arbitrary commands via a redirect to an scp: URL.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.19.4"
libcurl is affected by a buffer overflow in the handling of URLs for the TFTP protocol, which could be exploited to compromise a user's system.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.15.3 | >= 7.15.1-r1 (revision), >= 7.15.3, <= 7.14.1 |
cURL is a command line tool for transferring files with URL syntax, supporting numerous protocols. libcurl is the corresponding client-side library.
Ulf Harnhammar reported a possible buffer overflow in the handling of TFTP URLs in libcurl due to the lack of boundary checks.
An attacker could exploit this vulnerability to compromise a user's system by enticing the user to request a malicious URL with cURL/libcurl or to use a HTTP server redirecting to a malicious TFTP URL.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.15.1-r1"
cURL is vulnerable to local arbitrary code execution via buffer overflow due to the insecure parsing of URLs.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.15.1 | >= 7.15.1 |
cURL is a command line tool for transferring files with URL syntax, supporting numerous protocols.
Stefan Esser from the Hardened-PHP Project has reported a vulnerability in cURL that allows for a local buffer overflow when cURL attempts to parse specially crafted URLs. The URL can be specially crafted in one of two ways: the URL could be malformed in a way that prevents a terminating null byte from being added to either a hostname or path buffer; or the URL could contain a "?" separator in the hostname portion, which causes a "/" to be prepended to the resulting string.
An attacker capable of getting cURL to parse a maliciously crafted URL could cause a denial of service or execute arbitrary code with the privileges of the user making the call to cURL. An attacker could also escape open_basedir or safe_mode pseudo-restrictions when exploiting this problem from within a PHP program when PHP is compiled with libcurl.
There is no known workaround at this time.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.15.1"
cURL is vulnerable to a buffer overflow which could lead to the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.15.0 | >= 7.15.0 |
cURL is a command line tool and library for transferring files via many different protocols. It supports NTLM authentication to retrieve files from Windows-based systems.
iDEFENSE reported that insufficient bounds checking on a memcpy() of the supplied NTLM username can result in a stack overflow.
A remote attacker could setup a malicious server and entice an user to connect to it using a cURL client, potentially leading to the execution of arbitrary code with the permissions of the user running cURL.
Disable NTLM authentication by not using the --anyauth or --ntlm options when using cURL (the command line version). Workarounds for programs that use the cURL library depend on the configuration options presented by those programs.
All cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.15.0"
curl is vulnerable to a buffer overflow which could lead to the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/curl | * | < 7.13.1 | >= 7.13.1 |
curl is a command line tool for transferring files via many different protocols.
curl fails to properly check boundaries when handling NTLM authentication.
With a malicious server an attacker could send a carefully crafted NTLM response to a connecting client leading to the execution of arbitrary code with the permissions of the user running curl.
Disable NTLM authentication by not using the --anyauth or --ntlm options.
All curl users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-7.13.1"